Workspace Item Provisioning Rule Reference
Workspace Items are provisioned at two levels: an item is first assigned to or removed from a customer, and it can then be assigned to or removed from users within that customer. Provisioning Manager exposes item-level events and properties for both scopes, allowing rules to respond to the complete Workspace Item lifecycle.
Workspace uses the internal service name WorkSpace. Customer requests contain the standard customer-service properties, while user requests contain the standard user-service properties.
Provisioning scopes
| Scope | Trigger | Rule family | Additional context |
|---|---|---|---|
| Customer | A Workspace Item is assigned to or removed from a customer. | Event$Customer Service$WorkSpace$Item$<IDPType>$... | Customer, service, list, item, directory, and item configuration properties. |
| User | A Workspace Item is assigned to or removed from a user. | Event$User Service$WorkSpace$Item$<IDPType>$... | Customer, user, service, list, item, directory, and item configuration properties. |
<IDPType> is the identity-provider type configured by the Workspace Item Type, such as ActiveDirectory or AzureAD.
Rule locations
Customer Workspace Item events
Use customer item events when the action concerns making an item available to a customer or removing it from that customer. Common After extension points include:
Event$Customer Service$WorkSpace$Item$<IDPType>$After Provision
Event$Customer Service$WorkSpace$Item$<IDPType>$After Deprovision
Customer item events are suitable for creating or removing customer-level application resources, storage, configuration, or integrations. They do not include user identity properties because the request applies to the customer and item.
User Workspace Item events
Use user item events when the action concerns granting or removing an individual user's access to an item. Common After extension points include:
Event$User Service$WorkSpace$Item$<IDPType>$After Provision
Event$User Service$WorkSpace$Item$<IDPType>$After Deprovision
These events include the item values and the user identity context required for user-specific actions.
For both scopes, the full PreProvision, Provision, PostProvision, PreDeprovision, Deprovision, and PostDeprovision lifecycle is available, with Before, Main, and After rule sets. Use After for custom work that depends on Atria's standard item provisioning having completed, and avoid modifying the managed Main rules.
User service-level events
When an action concerns the user's Workspace service as a whole rather than any individual item, use the service-level extension points:
Event$User Service$WorkSpace$After Provision
Event$User Service$WorkSpace$After Deprovision
User service-level collections
Alongside the standard customer, user, and service values, a user-service request adds these collections to ServiceProperties:
| Service property | Shape | Description |
|---|---|---|
AddedItems | Hashtable | Workspace items being assigned, keyed by <ListId>-<ListItemId>-<ItemId>. |
RemovedItems | Hashtable | Workspace items being removed, using the same key format. |
AddedRoles | Hashtable | Roles being assigned, keyed by role ID. Added for multi-user provisioning. |
RemovedRoles | Hashtable | Roles being removed, keyed by role ID. Added for multi-user provisioning. |
The base rule value syntax can select a known entry, but these collections normally contain a variable number of items. For per-item work, use the customer or user item events instead of hard-coding a collection key.
Workspace Item properties
Workspace Item events promote the applicable item values to ordinary request properties. Entries within the user service-level AddedItems and RemovedItems collections use the same core item values.
| Group | Properties | Scope notes |
|---|---|---|
| Request | RequestType, Description, ObjectID | Present on customer item requests. |
| List identity | ListId, ListItemId, ListName | Identifies the source list and list entry used for the assignment. |
| Item identity | ItemId, ItemObjectId, ItemDisplayName, ItemDescription, SKU, Type | Identifies and describes the Workspace Item. |
| Item type | ItemTypeId, ItemTypeIconId, ItemTypeIconReference | Identifies the item's template and inherited presentation. |
| Directory target | IDPType, IDPGroupType, DirResName, DirResNameUID, DirUserGroupName, DirUserGroupNameUID, UserIDPType, UserIDPGroupType | Describes the identity provider and backing resource and user groups. |
| Presentation | IconId, IconReference, Tags | Tags is included on customer item requests. |
| Behaviour | ProvisioningString, NumberOfUsers, IsEnabled, IsCreateGroupItem, IsSharedItem, CustomerOnlyItem, IsDefault | CustomerOnlyItem and IsDefault are included on customer item requests. |
Workspace configuration values are available in the item's ConfigurationProperties collection. Their names depend on the Item Type and item configuration; for example, temporary group membership adds MembershipDurationEnabled, MembershipDurationDays, and MembershipDurationHours. Inspect a journalled request for the actual item before relying on an optional configuration key.
Each user service-level role entry contains RoleId and Name.
Properties promoted in item events
In a customer or user item event, the item values are available directly to Provisioning Manager rules. For example:
{ItemDisplayName}
{ProvisioningString}
{ListItemId}
{IDPType}
{DirUserGroupName}
{ConfigurationProperties}("MembershipDurationDays")
Customer properties remain available at both scopes. User item events also provide values such as {UserID}, {Username}, {Userfullname}, {UserEmail}, and {UserExternalEmail}.
Use Workspace Automation for item customisation
If the action belongs to a Workspace item or item type—creating an application container, assigning a user in an external application, managing storage, or archiving item data—configure it through Workspace Automation.
Workspace Automation:
- attaches a managed script to an item or item type;
- supports customer provision/deprovision and user assign/unassign events;
- passes the request context to the script in
$RequestProperties; - automatically selects the applicable Active Directory or Azure tenant context for the item type.
Use Provisioning Manager rules when an action must participate in a specific customer-service or user-service rule phase, or orchestrate the user's Workspace service as a whole. Prefer Workspace Automation for item-specific behaviour so the script follows the item across both customer and user assignment and removal lifecycles.
Example decision
| Requirement | Recommended location |
|---|---|
| Create a customer-specific application database when an item is assigned to the customer | Workspace Automation customer.provision event on that item |
| Remove customer-level application resources when the item is removed | Workspace Automation customer.deprovision event on that item |
| Notify an external system whenever the Workspace service is enabled for a user | Event$User Service$WorkSpace$After Provision |
| Create a database login only when a particular application item is assigned | Workspace Automation user.assign event on that item |
| Archive data when that application item is removed | Workspace Automation user.unassign event on that item |
| Perform final cleanup after the entire Workspace service is removed | Event$User Service$WorkSpace$After Deprovision |
Capture a journalled request for the actual customer or user operation before relying on optional configuration keys.